[lazerg]

variable_ptr was dereferenced up front and kept across user code. The old value's destructor (or a __toString() call during type coercion) could drop the reference it pointed into, so the write landed in freed memory. Check the property type first, then assign through the static slot with zend_assign_to_variable(), like zend_update_static_property_ex() does. That handles typed references and frees the old value only after the write.

Fixes #24729